Control

Decide what agents can see, request, and do.

Use Off, Ask first, and Allowed to decide which actions are hidden, which actions pause, and which actions can run when arguments match the configured scope.

Why Approval Belongs in the Tool Path

Approval is not just an interruption. It is how a session or workflow crosses from visible tools into actual authority to change something.

Current Exact Approval Shape

A capability grant in Ask mode queues the exact requested payload before execution. Approval is bound to that payload and revalidated against the live canonical grant, scope, policy attachments, and caller source before replay.

{
  "approvalId": "approval-...",
  "capabilityId": "github:pull_requests.create",
  "exactPayloadRef": "sha256:...",
  "status": "pending"
}

Canonical grant expiry and use limits apply before approval replay. Agent identities can also set expiresAt on the caller credential itself; once reached, the token cannot be used for future calls. Expiry does not undo external actions that already completed.

Useful Approval Outcomes

Do now	Approve and execute this exact action immediately.
Allow once	Permit one later matching action in the current context.
Allow for scope	Grant bounded authority for a repo, branch pattern, package action, time window, or workflow.
Allow indefinitely	Create standing authority until revoked. This should be used sparingly and shown explicitly.

Approval Is One Kind of Human Input

Capability packages can also ask for human input directly. An approval-shaped package request is a single-choice prompt with approve and reject options. ExecWarden projects that request into the same approval surfaces, and the answer can satisfy approval policy for the selected followup action.

Approval-shaped input

Use approve/reject when the person is deciding whether a risky provider call should proceed.

Generic input

Use free text, resume, or ordinary choices when the package needs a reason, option, missing value, or explicit handoff.

Audit trail

Approval-shaped answers are logged with the approval decision and the followup action they allow.

Need package-authored questions?	Use Human Input for missing values, reasons, choices, and approval-shaped package pauses.
Need repeatable approvals?	Use Workflows when a saved run needs to wait for approval or another human answer.